Intelligent security risk assessment

Abstract

A method, computer system, and computer program product for on-demand risk assessment in on-line transactions comprises: computing, by a machine intelligence application, a risk score for the individual; providing the risk score to a cache; and responsive to receiving new data regarding the individual, calculating a new risk score for the individual and replacing the risk score in the cache with the new score.

What is claimed is: 
     
       1. A computer-implemented method, the computer-implemented method comprising:
 responsive to receiving a message, calculating, by a machine intelligence application running on a processor unit, a risk score for an individual; and 
 providing, by the machine intelligence application running on the processor unit, the risk score to a cache; 
 wherein the message is triggered by an event regarding the individual in an external database or an internal database and is associated with new data regarding the individual enabling improved risk assessment that results in increased security in processing transactions in a computer system. 
 
     
     
       2. The computer-implemented method of  claim 1 , wherein the cache is configured to provide rapid access by a risk application in responding to client computers whose functioning adjusts based on risk score levels. 
     
     
       3. The computer-implemented method of  claim 1 , further comprising:
 ingesting and processing, by a data ingestion and processing application running on the processor unit, the new data regarding the individual associated with the message; and 
 responsive to ingesting and processing the new data regarding the individual, sending the new data to the machine intelligence application. 
 
     
     
       4. The computer-implemented method of  claim 3 , further comprising:
 responsive to receiving the new data regarding the individual, calculating, by the machine intelligence application running on the processor unit, a new risk score for the individual; and 
 replacing, by the machine intelligence application running on the processor unit, the risk score in the cache with the new risk score. 
 
     
     
       5. The computer-implemented method of  claim 1 , further comprising:
 receiving, by a data ingestion and orchestration application running on the processor unit, the new data regarding the individual; 
 responsive to receiving the new data regarding the individual, normalizing, by the data ingestion and orchestration application, running on the processor unit, the new data regarding the individual to form a normalized data; and 
 responsive to normalizing the new data regarding the individual to form the normalized data, providing, by the data ingestion and orchestration application running on the processor unit, the normalized data to the machine intelligence application. 
 
     
     
       6. The computer-implemented method of  claim 5 , wherein normalizing the new data comprises one or more of the following:
 converting, by a normalizer application running on the processor unit, a first portion of the new data to converted data; 
 combining, by the normalizer application running on the processor unit, a second portion of the new data to combined data; 
 reducing, by the normalizer application running on the processor unit, a third portion of the new data comprising duplicate data elements to form reduced data; 
 identifying, by the normalizer application running on the processor unit, a fourth portion of the new data comprising irrelevant data elements that are not relevant for prediction of fraud and risk evaluation to form not relevant data; and 
 identifying by the normalizer application running on the processor unit, a fifth portion of the new data comprising data elements that are relevant for prediction of fraud and risk evaluation to form relevant data. 
 
     
     
       7. The computer-implemented method of  claim 1 , wherein calculating the risk score, further comprises:
 discovering, by a risk assessor application running on the processor unit, patterns in the new data; 
 detecting, by the risk assessor application running on the processor unit, the patterns in the new data; and 
 detecting, by the risk assessor application running on the processor unit, anomalies based on the patterns in the data. 
 
     
     
       8. The computer implemented method of  claim 7 , wherein calculating the risk score comprises:
 calculating, using probabilistic neural network algorithms running on the processor unit, a statistically-weighted first numerical value for a number of the patterns; and 
 calculating, using the probabilistic neural network algorithms running on the processor unit, a second numerical value for a number of anomalies detected in the patterns. 
 
     
     
       9. The computer implemented method of  claim 8 , further comprising:
 applying machine learning algorithms, running on the processor unit, to adjust first statistical weights used for calculating a first numerical value; and 
 applying the machine learning algorithms to adjust second statistical weights used for calculating a second numerical value for the number of anomalies. 
 
     
     
       10. The computer-implemented method of  claim 3 , wherein the internal data comprises audit data logs, employment and human resource lifecycle changes, individual information data changes, role changes, device registration, financial data, changes in account numbers, changes in credit card numbers or data, employment data including employment status and history, authentication data, transactions, screen navigation, screen visitations, system data, and application logs. 
     
     
       11. The computer-implemented method of  claim 4 , wherein the external data comprises public records used to validate input data provided by other applications, individual information data, credit history information, social network data and activity, fraud detection service provided data known to be associated with fraud including internet protocol addresses, mobile devices numbers, email addresses, and mailing addresses. 
     
     
       12. A computer system for assigning a risk score to an individual, the computer system comprising:
 a processor unit; 
 a data ingestion and orchestration application running on the processor unit; 
 internal data sources connected to the data ingestion and orchestration application, the internal data sources configured to send a first message associated with an internal data item, responsive to a first triggering event, to the processor unit; 
 external data sources connected to the data ingestion and orchestration framework, the external sources configured to send a second message associated with an external data item, responsive to a second triggering event, to the processor unit; 
 a normalizer, running on the processor unit, to form normalized data from the internal data item and the external data item; and 
 a machine intelligence application having an algorithm configured to receive the normalized data and to compute the risk score for an individual using the normalized data. 
 
     
     
       13. The computer system of  claim 12 , wherein the data ingestion and orchestration application is optimized for rapid data ingestion on a large scale. 
     
     
       14. The computer system of  claim 12 , further comprising a cache connected to the machine intelligence application and to a risk assessment application, wherein the cache is configured to provide rapid access by a risk application in responding to client computers whose functioning adjusts based on risk score levels. 
     
     
       15. The computer system of  claim 14 , wherein the risk assessment application responds to incoming queries from any of an authentication application, a registration application, a financial transaction application, an employee benefit application, and other human resource oriented applications. 
     
     
       16. The computer system of  claim 14 , wherein the risk assessment application is connected via a pluggable mechanism to an identity intelligence system. 
     
     
       17. The computer system of  claim 12 , wherein the normalizer converts, combines, or reduces duplicate data elements;
 wherein the normalizer identifies irrelevant data elements that are not relevant for prediction of fraud and risk evaluation; and 
 wherein the normalizer identifies data elements that are relevant for prediction of fraud and risk evaluation. 
 
     
     
       18. The computer system of  claim 12 , wherein the machine intelligence application computes the risk score by discovering and detecting patterns in the data, and detecting anomalies based on the patterns in the data. 
     
     
       19. The computer system of  claim 18 , wherein the machine intelligence application further computes the risk score by
 calculating, using probabilistic neural network algorithms, a first statistically weighted numerical value for a first number of the patterns and a second statistically weighted numerical value for a second number of anomalies; 
 wherein the machine intelligence application adjusts statistical weights used for calculating the first numerical value in the probabilistic neural network algorithms, and adjusts weights used for calculating the second numerical value in the probabilistic neural network algorithms; and 
 wherein the machine intelligence application continually updates the risk score based on new data. 
 
     
     
       20. A computer program product for real time risk assessment comprising:
 a computer-readable storage media storing computer-readable instructions, the computer-readable instructions including:
 computer-readable instructions configured to cause a processor to request a risk score for an individual; 
 computer-readable instructions configured to cause a processor, responsive to receiving a request for a risk score, to access a cache; 
 computer-readable instructions configured to cause a processor, responsive to accessing the cache, to identify a risk score for the individual; and 
 computer-readable instructions configured to cause a processor, responsive to identifying the risk score for the individual, determining to determine whether to grant or deny access to an on-line transaction based on the risk score.